October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116516 Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat li... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116283 A weakness has been identified in Kameleo up to 5.0.1.26. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116274 A vulnerability has been found in JIZHICMS up to 2.5.6. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116275 A vulnerability was found in AllenAI AllenNLP up to 2.10.1. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116280 A vulnerability was determined in Kameleo up to 5.0.1.26. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116282 A security flaw has been discovered in Kameleo up to 5.3.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116213 Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability i... |
medium | 4.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116216 MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in in... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116217 RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116210 Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerabi... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116212 Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerab... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115195 A broken access control vulnerability exists in the Mautic Stats API (/api/stats... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115196 An Open Redirect vulnerability exists in the public form submission endpoint (/f... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115194 A path traversal vulnerability exists in the Mautic Asset API. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116263 A flaw has been found in HaschekSolutions PictShare up to 3.7.1. |
medium | 4.6 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116262 A vulnerability was detected in libimobiledevice up to 1.4.0. |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115718 Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vuln... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115720 Frappe Builder before 1.36.1 contains a server-side request forgery vulnerabilit... |
medium | 5.0 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105947 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-89209 A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All v... |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116258 A vulnerability was identified in libimobiledevice up to 1.4.0. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116259 A security flaw has been discovered in libimobiledevice up to 1.4.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115953 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115954 Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows E... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115955 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115956 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115959 Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommer... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115960 Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommer... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115961 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115950 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115951 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115594 Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115595 Missing Authorization vulnerability in Supsystic Contact Form by Supsystic conta... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114707 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114708 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116255 A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a15... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-97254 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-97255 Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-97295 Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary A... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115614 Missing Authorization vulnerability in Magepeople inc. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.